1 diff -ruNp modsecurity-2.9.0.orig/nginx/modsecurity/ngx_http_modsecurity.c modsecurity-2.9.0/nginx/modsecurity/ngx_http_modsecurity.c
2 --- modsecurity-2.9.0.orig/nginx/modsecurity/ngx_http_modsecurity.c 2015-02-12 20:08:31.000000000 +0100
3 +++ modsecurity-2.9.0/nginx/modsecurity/ngx_http_modsecurity.c 2015-07-31 23:34:31.601688075 +0200
8 + ngx_flag_t x_headers;
9 directory_config *config;
12 @@ -83,6 +84,12 @@ static ngx_command_t ngx_http_modsecuri
13 NGX_HTTP_LOC_CONF_OFFSET,
14 offsetof(ngx_http_modsecurity_loc_conf_t, enable),
16 + { ngx_string("ModSecurityXHeaders"),
17 + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_SIF_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
18 + ngx_conf_set_flag_slot,
19 + NGX_HTTP_LOC_CONF_OFFSET,
20 + offsetof(ngx_http_modsecurity_loc_conf_t, x_headers),
25 @@ -432,7 +439,11 @@ ngx_http_modsecurity_save_headers_in_vis
28 ngx_strlow(h->lowcase_key, h->key.data, h->key.len);
29 + h->lowcase_key[h->key.len] = '\0';
31 + if (!ngx_strcmp(h->lowcase_key, "host"))
34 h->hash = ngx_hash_key(h->lowcase_key, h->key.len);
36 cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);
37 @@ -737,8 +748,10 @@ ngx_http_modsecurity_save_headers_out_vi
38 ngx_table_elt_t *h, he;
39 ngx_http_upstream_header_t *hh;
40 ngx_http_upstream_main_conf_t *umcf;
41 + ngx_table_elt_t *tmp_header;
43 umcf = ngx_http_get_module_main_conf(r, ngx_http_upstream_module);
44 + ngx_http_modsecurity_loc_conf_t *conf = ngx_http_get_module_loc_conf(r, ngx_http_modsecurity);
48 @@ -755,6 +768,19 @@ ngx_http_modsecurity_save_headers_out_vi
50 ngx_strlow(h->lowcase_key, h->key.data, h->key.len);
52 + if (conf->x_headers) {
53 + h->lowcase_key[h->key.len] = '\0';
54 + if (h->lowcase_key[0] == 'x' &&
55 + h->lowcase_key[1] == '-') {
57 + tmp_header = ngx_list_push(&r->headers_out.headers);
58 + tmp_header->key = h->key;
59 + tmp_header->value = h->value;
60 + tmp_header->hash = 1;
65 h->hash = ngx_hash_key(h->lowcase_key, h->key.len);
67 hh = ngx_hash_find(&umcf->headers_in_hash, h->hash,
68 @@ -810,6 +836,7 @@ ngx_http_modsecurity_create_loc_conf(ngx
70 conf->config = NGX_CONF_UNSET_PTR;
71 conf->enable = NGX_CONF_UNSET;
72 + conf->x_headers = NGX_CONF_UNSET;
76 @@ -823,6 +850,7 @@ ngx_http_modsecurity_merge_loc_conf(ngx_
77 ngx_http_modsecurity_loc_conf_t *conf = child;
79 ngx_conf_merge_value(conf->enable, prev->enable, 0);
80 + ngx_conf_merge_value(conf->x_headers, prev->x_headers, 0);
81 ngx_conf_merge_ptr_value(conf->config, prev->config, NULL);
83 if (conf->enable && conf->config == NULL) {